![]() The majority of the episodes were recorded from lockdown, as a global pandemic upends lives and livelihoods of people everywhere, this has resulted in interesting perspectives on what a post-pandemic industry could look like from these leading minds. This season host Damian Bradfield, WeTransfer’s CCO, talks to visionaries like Cindy Gallop, Troy Carter, Rana El-Kaliouby and Matthew Freud about the people, the technology and the ideas that are catapulting the industry into the future – for better or worse. Season 1 took listeners on a journey through the history of advertising and the events that shaped the industry today. However, Antigena Email reveals that the true sender is an unrelated and uncommon domain, and one that is unrelated to WeTransfer.The advertising world just changed (again), and season two of WeTransfer’s advertising podcast, Influence, is here to help you keep up. The familiarity of this apparent sender is reflected in the ‘Depth’ and ‘Width’ scores below of 19 and 47 respectively, indicating moderate communication history. As a result, an email sent from an attacker’s mail server is verified as coming from a legitimate address in this case. Some of these techniques may be as simple as including two From lines in an email header, which may result in a mail server verifying the first From header while the email client displays the second From address. Recent research unveiled at Black Hat this month indicates there could be as many as 18 different methods to mislead common email verification checks like Domain Keys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). Whereas in the previous scenario the attacker simply changed the personal name, leveraging, here the attacker has manipulated the headers to actually make the email appear to come from the WeTransfer domain. However, it still set off over a dozen models, again prompting Antigena to lock links and hold the email back.įigure 4: An interactive UI snapshot of the second email This email was more sophisticated and even more convincing, appearing to come from the legitimate WeTransfer domain. Incident twoĪ second incident leveraging WeTransfer’s name was detected just a week later at a law firm in Europe. These, and other characteristics, of the URL gave Darktrace’s AI reason to tag this email with the ‘Suspicious Link’ tag, prompting Antigena Email to double lock the offending link and hold the message back from the recipient’s inbox. The AI also recognized that neither the employee in the accounting department nor anybody else in the organization had previously visited the domain in question, and deemed this email as 100% anomalous. It would be highly unusual for WeTransfer to link to SharePoint – a direct competitor – in their emails. ![]() If a user entered their username and password in an attempt to access this ‘invoice’, the malware would harvest their credentials and send them to the attacker.įigure 3: Antigena Email’s dashboard reveals key metadata behind the emailĬritical for Antigena Email’s detection of this attack was that the email contained an anomalous link. Hidden behind a button reading ‘Get your files’ was a webpage that contained malware but displayed a login page. The subject line of this email – “We sent you an invoice via WeTransfer” – is typical of a solicitation attack. This email was directed at an employee in the accounts department of a financial services organization in the APAC region.įigure 1: An interactive snapshot of Antigena Email’s user interface We’ve seen similar attacks recently with both QuickBooks and Microsoft Teams. This is a common technique deployed by attackers, who find success in masquerading behind the trusted brand of well-known SaaS vendors. These attacks attempt to deploy malware into the recipient’s device and further infiltrate an organization. In recent months, Antigena Email has seen a surge in email attacks claiming to be from file sharing site WeTransfer.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |